agentsclimarketplace
Sign in

Check my vibe

Skill daanaagua/check-my-vibe-skill/skills/check-my-vibe

Use when a user wants to review the public security posture of an AI-generated, vibe-coded, or deployed website through an authorized passive scan, especially for security headers, exposed secrets, source maps, public files, and deployment mistakes.From its SKILL.md

Install
npx -y skills add daanaagua/check-my-vibe-skill --skill check-my-vibe

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

2.5 KB, 479 tokens by cl100k_base, as published. Nobody here has run it

Check My Vibe

Overview

Use Check My Vibe for an authorized, passive review of one public website. Run the real scan at https://checkmyvibeapp.com/; never invent results or replace it with an unprotected API call.

Workflow

  1. Get the target URL.
  2. Confirm authorization: the user must own the target or have the owner's permission. Stop if authorization is absent.
  3. Open https://checkmyvibeapp.com/ in the available browser.
  4. Enter the target URL. The user must complete Turnstile; never bypass or solve it for them.
  5. Start the scan and wait for a completed or failed result.
  6. Read the score, coverage, limited or partial state, findings, evidence, remediation, limits, and errors.
  7. Report only findings supported by the scan evidence.

If no browser is available, give the user the Check My Vibe URL and ask them to paste the resulting report. Do not simulate the scan or call the protected endpoint directly.

Response Format

  • Summary: Target, score, coverage, and whether the scan was partial or limited.
  • Fix now: Critical and high findings, ordered by risk and dependencies.
  • Fix next: Medium and low findings.
  • Manual review: Review, not-tested, partial, or weak-evidence items.
  • Top three actions: The highest-value next steps.
  • Coverage limits: What this passive public-surface scan did not verify.

Boundaries

The scan does not prove a site is secure. It does not validate authenticated areas, database authorization, private repositories, business logic, complete dependency risk, or full penetration-test coverage. It does not log in, submit target forms, exploit vulnerabilities, or recursively crawl the site.

Never request passwords, API keys, cookies, or private source code. For verification failure, rate limiting, invalid targets, or safely unreachable pages, explain the error and use the site's normal retry path without changing identity or bypassing controls.

Common Mistakes

  • Treating a public URL as permission to scan it.
  • Claiming that a clean report means the site is secure.
  • Guessing code locations or vulnerabilities not present in the evidence.
  • Bypassing Turnstile, same-origin checks, rate limits, or URL safety rules.

What ships with it: 1 file

211 B alongside SKILL.md

agents/

Gives 0 of the 12 instructions most quality gates skills give in 479 tokens

Counted across 1,195 of the 2,094 authors here whose files we hold, read 2026-08-07

  • Read the output and check the exit codein 54 of 1195, across 14 files
  • Verify requirements using a line-by-line checklistin 53 of 1195, across 12 files
  • Identify the verification command proving the claimin 51 of 1195, across 12 files
  • Run the full verification commandin 50 of 1195, across 11 files
  • Verify output confirms the claimin 49 of 1195, across 12 files
  • Check version control diff after agent delegationin 46 of 1195, across 6 files
  • State claim with evidencein 44 of 1195, across 4 files
  • Run the test suitein 33 of 1195, across 26 files
  • Keep state in memory by defaultin 27 of 1195, across 6 files
  • Make prototype runnable with one commandin 26 of 1195, across 5 files
  • Produce a verification reportin 25 of 1195, across 14 files
  • Detect the package manager from lockfilesin 24 of 1195, across 5 files

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.

Keep looking

Skills are one crate of 326,144. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.